Reproduce the error:
1. Export the results of a previous search job (a table with 22 fields and 32k+ rows) as a CSV.
2. Attempt to upload CSV as a new lookup file with CSV filetype selected.
Why do I get this error? I've seen error messages similar to this for other peoples' questions but I have not seen any where the issue comes from trying to upload a CSV as a lookup file.
Did you ever figure out how to resolve this error? I'm currently having the same issue. @russell120
I have seen this error when my authentication to Splunk has expired.
When I reauthenticate, the error has gone away.
It sounds like it's trying to ingest the file as a json rather than as a csv. Perhaps somebody touched the file with Excel and Microsoft converted it?
First, verify that the file is, in fact, a plain csv down on the box, by attempting to edit it with a vanilla editor (notepad++ or something like that).
Second, step through the upload one item at a time and read every instruction or message. This sounds vaguely familiar, and I'm pretty sure it's just either the file has been altered or an option that went wonky.